feat: support delegation permissions

Author: raymondk

ic-transport-types/src/lib.rs

@@ -391,6 +391,20 @@ pub struct Delegation {
     /// If present, this delegation only applies to requests sent to one of these canisters.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub targets: Option<Vec<Principal>>,
+    /// If present, this delegation only applies to the specified kinds of requests.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub permissions: Option<DelegationPermissions>,
+}
+
+/// The kinds of requests a [`Delegation`] permits.
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Hash, Serialize, Deserialize)]
+pub enum DelegationPermissions {
+    /// Only query calls and `read_state` requests are permitted.
+    #[serde(rename = "queries")]
+    Queries,
+    /// All request types are permitted.
+    #[serde(rename = "all")]
+    All,
 }
 
 const IC_REQUEST_DELEGATION_DOMAIN_SEPARATOR: &[u8] = b"\x1Aic-request-auth-delegation";

ref-tests/tests/integration.rs

@@ -717,6 +717,7 @@ mod identity {
             expiration: i64::MAX as u64,
             pubkey: signing_identity.public_key().unwrap(),
             targets: None,
+            permissions: None,
         };
         let signature = sending_identity.sign_delegation(&delegation).unwrap();
         let delegated_identity = DelegatedIdentity::new(
@@ -755,6 +756,7 @@ mod identity {
             expiration: i64::MAX as u64,
             pubkey: signing_identity.public_key().unwrap(),
             targets: None,
+            permissions: None,
         };
         let signature = sending_identity.sign_delegation(&delegation).unwrap();
         let delegated_identity = DelegatedIdentity::new(
@@ -808,6 +810,7 @@ mod identity {
                 pubkey: signing_identity.public_key().unwrap(),
                 expiration: i64::MAX as u64,
                 targets: None,
+                permissions: None,
             };
 
             // Build the signature tree:
@@ -904,6 +907,7 @@ mod identity {
                 pubkey: signing_identity.public_key().unwrap(),
                 expiration: i64::MAX as u64,
                 targets: None,
+                permissions: None,
             };
 
             // Compute hash of the delegation message.